Server-Side Request Forgery and Open Redirect in AllTube Download
Impact
On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured).
The impact is mitigated by the fact the SSRF attack is only possible when the stream option is enabled in the configuration. (This option is disabled by default.)
Patches
3.0.3 contains a fix for this vulnerability. (The 1.x and 2.x releases are not maintained anymore.)
The fix requires applying a patch to youtube-dl to disable its generic extractor. If you are using the version of youtube-dl bundled with 3.0.3, it is already patched. However, if you are using your own unpatched version of youtube-dl you might still be vulnerable.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | rudloff/alltube | < 3.0.3 | 3.0.3 |
References
- https://github.com/Rudloff/alltube/security/advisories/GHSA-75p7-527p-w8wp
- https://nvd.nist.gov/vuln/detail/CVE-2022-24739
- https://github.com/ytdl-org/youtube-dl/issues/30691
- https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d
- https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a
- https://github.com/Rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a
- https://github.com/FriendsOfPHP/security-advisories/blob/master/rudloff/alltube/CVE-2022-24739.yaml
- https://github.com/Rudloff/alltube
- https://github.com/Rudloff/alltube/releases/tag/3.0.3
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L- Weakness (CWE)
CWE-601, CWE-918- Platform
- Composer
- Package
rudloff/alltube- Disclosed
- 09.03.2022
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-75p7-527p-w8wp - CC BY 4.0
Vulnerability history: rudloff/alltube
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 02.2022 03.2022
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
- Medium 1
Disclosures per year
- 2022: 3
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Server-Side Request Forgery and Open Redirect in AllTube Download this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.